1
PKI
Public Key Infrastructure. Public Key Infrastructure. Group of technologies used to request, create, manage, store, distribute, and revoke digital certificates. Certificates include public keys along with details on the owner of the certificate, and on the CA that issued the certificate. Certificate owners share their public key by sharing a copy of their certificate. A PKI requires a trust model between CAs and most trust models are hierarchical and centralized with a central root CA.
RAD
Rapid Application Development. Rapid Application Development (RAD) in cybersecurity is a methodology for quickly building and updating security applications by using rapid prototyping, iterative development, and user feedback.
RIPEMD
RACE Integrity Primitives Evaluation Message Digest. RACE Integrity Primitives Evaluation Message Digest. A hash function used for integrity. It creates fixed-length hashes of 128, 160, 256, or 320 bits.
SaaS
Software as a Service. Software as a Service. A cloud computing technology that provides applications over the Internet. Web mail is an example of a cloud-based technology. Compare to IaaS and PaaS.
SDLC
Software Development Life Cycle. Software Development Life Cycle. A software development process. Many different models are available.
SLA
Service Level Agreement. Service level agreement. An agreement between a company and a vendor that stipulates performance expectations, such as minimum uptime and maximum downtime levels. Organizations use SLAs when contracting services from service providers such as Internet Service Providers (ISPs).
SPIM
Spam over Internet Messaging. Spam over Internet Messaging. A form of spam using instant messaging that targets instant messaging users.
TACACS+
Terminal Access Controller Access Control System Plus. Terminal Access Controller Access-Control System +. Provides central authentication for remote access clients and used as an alternative to RADIUS. TACACS + uses TCP port 49. It encrypts the entire authentication process, compared with RADIUS, which only encrypts the password. It uses multiple challenges and responses.
UDP
User Datagram Protocol. User Datagram Protocol. Used instead of TCP when guaranteed delivery of each packet is not necessary. UDP uses a best-effort delivery mechanism.
VDI
Virtual Desktop Infrastructure. Virtualization Desktop Infrastructure. Virtualization software designed to reproduce a desktop operating system as a virtual machine on a remote server.
WIDS
Wireless Intrusion Detection System. Wireless intrusion detection system. An IDS used for wireless networks.
XSS
Cross-site Scripting. Cross-site scripting. Attackers use XSS to capture user information such as cookies. Input validation techniques on the server-side help prevent XSS attacks by blocking HTML and JavaScript tags. Many sites prevent the use of < and > characters to block cross-site scripting.
POODLE
Padding Oracle on Downgrade Legacy Encryption. The Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability is a 2014 cybersecurity flaw in the outdated SSLv3.0 protocol that allows an attacker to decrypt encrypted data by forcing a connection downgrade to SSLv3.0.
RADIUS
Remote Authentication Dial-in User Server. Remote Authentication Dial-In User Service. Provides central authentication for remote access clients. RADIUS uses symmetric encryption to encrypt the password packets and it uses UDP. In contrast, TACACS + encrypts the entire authentication process and uses TCP. Diameter is an improvement over RADIUS.
ROI
Return of investment or return on investment. A performance measure used to identify when an investment provides a positive benefit to the investor. It is sometimes considered when evaluating the purchase of new security controls.
SAML
Security Assertions Markup Language. Security Assertions Markup Language. An XML-based standard used to exchange authentication and authorization information between different parties. SAML provides SSO for web-based applications.
SDLM
Software Development Life Cycle Methodology. Software Development Life Cycle Methodology. The practice of using a SDLC when developing applications.
SLE
Single Loss Expectancy. Single loss expectancy. The SLE identifies the amount of each loss and is used to measure risk with ALE and ARO in a quantitative risk assessment. The calculation is SLE × ARO = ALE.
SPoF
Single Point of Failure. Single point of failure. An SPOF is any component whose failure results in the failure of an entire system. Elements such as RAID, failover clustering, UPS, and generators remove many single points of failure.
TCP/IP
Transmission Control Protocol/Internet Protocol. Transmission Control Protocol/ Internet Protocol. Represents the full suite of protocols used on the Internet and most internal networks.
UEFI
Unified Extensible Firmware Interface. Unified Extensible Firmware Interface. A method used to boot some systems and intended to replace Basic Input/ Output System (BIOS) firmware.
VLAN
Virtual Local Area Network. Virtual local area network. A VLAN separates or segments traffic. A VLAN can logically group several different computers together, or logically separate computers, without regard to their physical location. It is possible to create multiple VLANs with a single switch. You can also create VLANs with virtual switches.
WIPS
Wireless Intrusion Prevention System. Wireless intrusion prevention system. An IPS used for wireless networks.
802.1x
A port-based authentication protocol. Wireless can use 802.1x. For example, WPA2 Enterprise mode uses an 802.1x server (implemented as a RADIUS server). Enterprise mode requires an 802.1x server. PEAP and EAP-TTLS require a certificate on the 802.1x server. EAP-TLS also uses TLS, but it requires certificates on both the 802.1x server and each of the clients.
POP
Post Office Protocol. Post Office Protocol (POP), especially version 3 (POP3), is a standard email protocol for retrieving messages from a server, primarily designed to download emails to a local device. In cybersecurity, its main risk is its traditional, unencrypted operation on port 110, which sends data in plain text and leaves credentials and emails vulnerable.
RAID
Redundant Array of Inexpensive Disks. Redundant array of inexpensive disks. Multiple disks added together to increase performance or provide protection against faults. RAID help prevent disk subsystems from being a single point of failure.
RMF
Risk Management Framework. A cyber risk management framework is a structured approach to identifying, assessing, managing, and mitigating cyber risks.
SAN
Storage Area Network. Storage Area Network. A specialized network of high-speed storage devices.
SDN
Software Defined Network. Software-Defined Networking (SDN) enhances cybersecurity by separating the network's control and data planes, which allows for centralized, automated management and real-time security policy enforcement.
SMB
Server Message Block. Server Message Block (SMB) is a network protocol for sharing files and printers, but its use in cyber security makes it a frequent target for attackers due to its widespread use in Windows networks and its history of vulnerabilities.
SQL
Structured Query Language. Structured Query Language. Used by SQL-based databases, such as Microsoft SQL Server. Web sites integrated with a SQL database are subject to SQL injection attacks. Input validation with forms and stored procedures help prevent SQL injection attacks. Microsoft SQL Server uses TCP port 1433 by default.
TGT
Ticket Granting Ticket. Ticket Granting Ticket. Used with Kerberos. A KDC (or TGT server) issues timestamped tickets that expire after a certain time period.
UPS
Uninterruptable Power Supply. Uninterruptible power supply. A battery backup system that provides fault tolerance for power and can protect against power fluctuations. A UPS provides short-term power giving the system enough time to shut down smoothly, or to transfer to generator power. Generators provide long-term power in extended outages.
VLSM
Variable Length Subnet Masking. Variable Length Subnet Masking (VLSM) is a network design strategy that uses different-sized subnets within the same network to improve IP address efficiency, network scalability, and resource optimization.
WORM
Write Once Read Many. Write Once Read Many (WORM) is a data storage principle that ensures data, once written, cannot be altered, overwritten, or deleted for a specified period or indefinitely
ACE
Access Control Entry. Identifies a user or group that is granted permission to a resource. ACEs are contained within a DACL in NTFS.
POTS
Plain Old Telephone Service. Plain old telephone service. Voice-grade telephone service using traditional telephone wires.
RAS
Remote Access Server. Remote Access Service. Provides access to an internal network from an outside source location using dial-up or a VPN.
RPO
Recovery Point Objective. Recovery point objective. The recovery point objective (RPO) refers to the amount of data you can afford to lose by identifying a point in time where data loss is acceptable. It is related to RTO and the BIA often includes both RTOs and RPOs.
SAN
Subject Alternative Name. a Subject Alternative Name (SAN) allows a single SSL/TLS certificate to secure multiple domain names, subdomains, and IP addresses.
SED
Self-encrypting Drive. Software-Defined Networking (SDN) enhances cybersecurity by separating the network's control and data planes, which allows for centralized, automated management and real-time security policy enforcement.
SMS
Short Message Service. Short Message Service (SMS) is both a security risk and a security tool. It is widely used for malicious attacks like smishing (SMS phishing), where attackers send fraudulent texts to steal sensitive information.
SRTP
Secure Real-Time Protocol. Secure Real-time Transport Protocol (SRTP) is a security-enhanced version of the Real-time Transport Protocol (RTP) that secures audio and video communications by providing confidentiality, integrity, and replay protection through encryption and authentication
TKIP
Temporal Key Integrity Protocol. Temporal Key Integrity Protocol. Wireless security protocol introduced to address the problems with WEP. TKIP was used with WPA but has been deprecated. WPA2 with CCMP is recommended instead.
URI
Uniform Resource Identifier. Uniform Resource Identifier. Used to identify the name of a resource and always includes the protocol such as http:// GetCertifiedGetAhead.com.
VM
Virtual Machine. Virtual machine. A virtual system hosted on a physical system. A physical server can host multiple VMs as servers. Virtualization helps reduce the amount of physical equipment required, reducing overall physical security requirements such as HVAC and power.
WPA
WiFi Protected Access. Wi-Fi Protected Access. Replaced WEP as a wireless security protocol without replacing hardware. Originally used TKIP with RC4 and later implementations support AES. Superseded by WPA2. In WPA cracking attacks, attackers capture the four-way authentication handshake and then use a brute force attack to discover the passphrase.
ACK
Acknowledge. A packet in a TCP handshake. In a SYN flood attack, attackers send the SYN packet, but don't complete the handshake after receiving the SYN/ ACK packet.
PPP
Point-to-Point Protocol. Point-to-Point Protocol. Used to create remote access connections. Used by PAP and CHAP.
RAT
Remote Access Trojan. Remote access tool. Commonly used by APTs and other attackers. A RAT gives an attacker full control over a user's system from a remote location over the Internet.
RSA
Rivest, Shamir, & Adleman. Rivest, Shamir, and Adleman. An asymmetric algorithm used to encrypt data and digitally sign transmissions. It is named after its creators, Rivest, Shamir, and Adleman. RSA uses both a public key and a private key in a matched pair.
SCADA
System Control and Data Acquisition. Supervisory control and data acquisition. Typically industrial control systems within large facilities such as power plants or water treatment facilities. SCADA systems are often contained within isolated networks that do not have access to the Internet, but are still protected with redundant and diverse security controls. SCADA systems can be protected with NIPS systems and VLANs.
SEH
Structured Exception Handler. Structured Exception Handler. Module within an application that handles errors or exceptions. It prevents applications from crashing or responding to events that can be exploited by attackers.
SMTP
Simple Mail Transfer Protocol. Simple Mail Transfer Protocol. Used to transfer email between clients and servers and between email servers and other email servers. SMTP uses TCP port 25.
SSD
Solid State Drive. Solid State Drive. A drive used in place of a traditional hard drive. An SSD has no moving parts, but instead stores the contents as nonvolatile memory. SSDs are much quicker than traditional drives.
TLS
Transport Layer Security. Transport Layer Security. Used to encrypt data in transit. TLS is the replacement for SSL and like SSL, it uses certificates issued by CAs. PEAP-TLS uses TLS to encrypt the authentication process and PEAP-TLS requires a CA to issue certificates.
URL
Universal Resource Locator. Uniform Resource Locator. A type of URI. Address used to access web resources, such as http:// GetCertifiedGetAhead.com. Pop-up blockers can include URLs of sites where pop-ups are allowed.
VoIP
Voice over IP. Voice over IP. A group of technologies used to transmit voice over IP networks. Vishing is a form of phishing that sometimes uses VoIP.
WPA2
WiFi Protected Access 2. Wi-Fi Protected Access II. Security protocol used to protect wireless transmissions. It supports CCMP for encryption, which is based on AES and is stronger than TKIP, which was originally released with WPA. It uses an 802.1x server for authentication in WPA2 Enterprise mode and a preshared key for WPA2 Personal mode, also called WPA2-PSK.
ASCII
American Standard Code for Information Interchange. Code used to display characters.
PPTP
Point-to-Point Tunneling Protocol. Point-to-Point Tunneling Protocol. Tunneling protocol used with VPNs. PPTP uses TCP port 1723.
RBAC
Role-based Access Control. Role-based access control. An access control model that uses roles based on jobs and functions to define access and it is often implemented with groups (providing group-based privileges). Often uses a matrix as a planning document to match roles with the required privileges.
RTBH
Remotely Triggered Black Hole. Remotely Triggered Black Hole (RTBH) is a cyber security technique that uses Border Gateway Protocol (BGP) to drop malicious traffic at the network edge before it reaches its target.
SCAP
Security Content Automation Protocol. Security Content Automation Protocol. A set of security specifications for various applications and operating systems. Compliance tools such as vulnerability scanners use these to check systems for compliance.
SFTP
Secured File Transfer Protocol. Secure File Transfer Protocol. An extension of Secure Shell (SSH) using SSH to transmit the files in an encrypted format. SFTP transmits data using TCP port 22.
SMTPS
Simple Mail Transfer Protocol Secure. Simple Mail Transfer Protocol Secure (SMTPS) is a method for securing email transmissions by using encryption, such as TLS or SSL, to protect the confidentiality and integrity of data in transit.
SSH
Secure Shell. Secure Shell. SSH encrypts a wide variety of traffic such as SCP, SFTP, Telnet, and TCP Wrappers. SSH uses TCP port 22. SSH is a more secure alternative than Telnet.
TOTP
Time-based One-time Password. Time-based One-Time Password. Similar to HOTP, but it uses a timestamp instead of a counter. One-time passwords created with TOTP expire after 30 seconds.
USB
Universal Serial Bus. Universal Serial Bus. A serial connection used to connect peripherals such as printers, flash drives, and external hard disk drives. Data on USB drives can be protected against loss of confidentiality with encryption. Attackers have spread malware through Trojans.
VPN
Virtual Private Network. Virtual private network. Provides access to a private network over a public network such as the Internet. VPN concentrators provide VPN access to large groups of users.
WPS
WiFi Protected Setup. Wi-Fi Protected Setup. Allowed users to easily configure a wireless network, often by using only a PIN. WPS brute force attacks can discover the PIN.
BIND
Berkeley Internet Name Domain. BIND is DNS software that runs on Linux and Unix servers. Most Internet-based DNS servers use BIND.
PSK
Pre-shared Key. Preshared key. A secret shared among different systems. Wireless networks support Personal mode, where each device uses the same PSK. In contrast, Enterprise mode uses an 802.1x or RADIUS server for authentication.
RBAC
Rule-based Access Control. Rule-based access control. An access control model that uses rules to define access. Rule-based access control is based on a set of approved instructions, such as an access control list, or rules that trigger in response to an event such as modifying ACLs after detecting an attack.
RTO
Recovery Time Objective. Recovery time objective. An RTO identifies the maximum amount of time it should take to restore a system after an outage. It is derived from the maximum allowable outage time identified in the BIA.
SCEP
Simple Certificate Enrollment Protocol. Simple Certificate Enrollment Protocol. A method of requesting a certificate from a CA.
SHA
Secure Hashing Algorithm. Secure Hash Algorithm. A hashing function used to provide integrity. SHA-1 uses 160 bits, and SHA-256 uses 256 bits. As with other hashing algorithms, SHA verifies integrity.
SNMP
Simple Network Management Protocol. Simple Network Management Protocol. Used to manage and monitor network devices such as routers or switches. SNMP agents report information via notifications known as SNMP traps, or SNMP device traps. SNMP uses UDP ports 161 and 162.
SSID
Service Set Identifier. Service Set Identifier. Identifies the name of a wireless network. Disabling SSID broadcast can hide the network from casual users, but an attacker can easily discover it with a wireless sniffer. It's recommended to change the SSID from the default name.
TPM
Trusted Platform Module. Trusted Platform Module. A hardware chip on the motherboard included on many newer laptops. A TPM includes a unique RSA asymmetric key, and when first used, creates a storage root key. TPMs generate and store other keys used for encryption, decryption, and authentication. TPM provides full disk encryption.
USB OTG
USB On The Go. USB On-The-Go (OTG) poses cybersecurity risks because it allows devices like phones and tablets to act as a host, enabling direct connection to other USB devices such as flash drives, keyboards, or mice.
VTC
Video Teleconferencing. Video teleconferencing. A group of interactive telecommunication technologies that allow people in two or more locations to interact with two-way video and audio transmissions.
WTLS
Wireless TLS. Wireless Transport Layer Security. Used to encrypt traffic for smaller wireless devices.
CIA
onfidentiality, integrity, and availability. These three form the security triad. Confidentiality helps prevent the unauthorized disclosure of data. Integrity provides assurances that data has not been modified, tampered with, or corrupted. Availability indicates that data and services are available when needed.
PTZ
Pan-Tilt-Zoom. Pan tilt zoom. Refers to cameras that can pan (move left and right), tilt (move up and down), and zoom to get a closer or a wider view.
RC4
Rivest Cipher version 4. Rivest Cipher 4. A popular stream cipher. RC4 was implemented incorrectly in WEP, causing vulnerabilities. A rare spelling for RC4 is RSA Variable Key Size Encryption Algorithm.
RTOS
Real-time Operating System. RTOS (real-time operating system) cybersecurity focuses on securing embedded systems that have strict timing requirements.
SCP
Secure Copy. Secure Copy. Based on SSH, SCP allows users to copy encrypted files over a network. SCP uses TCP port 22.
SHTTP
Secure Hypertext Transfer Protocol. Secure Hypertext Transfer Protocol. An alternative to HTTPS. Rarely used.
SOAP
Simple Object Access Protocol. Simple Object Access Protocol (SOAP) is a messaging protocol that can be both a risk and a tool.
SSL
Secure Sockets Layer. Secure Sockets Layer. Used to encrypt data in transit with the use of certificates. SSL is used with HTTPS to encrypt HTTP traffic and can also encrypt SMTP and LDAP traffic.
TSIG
Transaction Signature. Transaction Signature. A method of securely providing updates to DNS with the use of authentication.
UTM
Unified Threat Management. Unified threat management. A security appliance that combined multiple security controls into a single solution. UTM appliances can inspect data streams for malicious content and often include URL filtering, malware inspection, and content inspection components.
WAF
Web Application Firewall. Web application firewall. A firewall specifically designed to protect a web application, such as a web server. A WAF inspects the contents of traffic to a web server, can detect malicious content such as code used in a cross-scripting attack, and block it.
XML
Extensible Markup Language. Extensible Markup Language. Used by many databases for inputting or exporting data. XML uses formatting rules to describe the data.
CVE
Common Vulnerabilities and Exposures (CVE). A dictionary of publicly known security vulnerabilities and exposures.
RA
Recovery Agent. Recovery agent. A designated individual who can recover or restore cryptographic keys. In the context of a PKI, a recovery agent can recover private keys to access encrypted data, or in some situations, recover the data without recovering the private key. In some cases, recovery agents can recover the private key from a key escrow.
RDP
Remote Desktop Protocol. Remote Desktop Protocol. Used to connect to remote systems. Microsoft uses RDP in different services such as Remote Desktop Services and Remote Assistance. RDP uses either port TCP 3389 or UDP 3389.
RTP
Real-time Transport Protocol. Real-time Transport Protocol. A standard used for delivering audio and video over an IP network.
SCSI
Small Computer System Interface. Small Computer System Interface. Set of standards used to connect peripherals to computers. Commonly used for SCSI hard disks and/ or tape drives.
SIEM
Security Information and Event Management. Security Information and Event Management. A security system that attempts to look at security events throughout the organization.
SoC
System on Chip. a System on a Chip (SoC) refers to the use of a single integrated circuit to build security features directly into the hardware, creating a dedicated security subsystem with features like secure boot and hardware-based encryption to protect sensitive data and platform integrity.
SSO
Single Sign-on. Single sign-on. Authentication method where users can access multiple resources on a network using a single account. SSO can provide central authentication against a federated database for different operating systems.
UAT
User Acceptance Testing. User Acceptance Testing. One of the last phases of testing an application before its release.
UTP
Unshielded Twisted Pair. Unshielded twisted-pair. Cable type used in networks that do not have any concerns over EMI, RFI, or cross talk. If these are a concern, STP is used.
WAP
Wireless Access Point. Wireless access point, sometimes called an access point (AP). Provides wireless clients connectivity to a wired network. Most WAPs use an omnidirectional antenna. You can connect two WLANs together using high-gain directional Yagi antennas. Increasing the power level of a WAP increases the wireless coverage of the WAP. Decreasing the power levels decreases the coverage.
XOR
Exclusive Or. XOR (exclusive or) is a fundamental bitwise operation used in cybersecurity for encryption, obfuscation, and as a building block in more complex protocols.
DACL
Discretionary access control list. List of Access Control Entries (ACEs) in Microsoft NTFS. Each ACE includes a security identifier (SID) and a permission.
RA
Registration Authority. A Registration Authority is a trusted entity that verifies user identities and requests for digital certificates before a Certificate Authority issues them.
RFID
Radio Frequency Identifier. Radio frequency identification. RFID methods are often used for inventory control.
S/MIME
Secure/Multipurpose Internet Mail Extensions. Secure/ Multipurpose Internet Mail Extensions. Used to secure email. S/ MIME provides confidentiality, integrity, authentication, and non-repudiation. It can digitally sign and encrypt email, including the encryption of email at rest and in transit. It uses RSA, with public and private keys for encryption and decryption, and depends on a PKI for certificates.
SDK
Software Development Kit. a Software Development Kit (SDK) is a collection of tools that helps developers build new security applications, like anti-malware software or identity management systems.
SIM
Subscriber Identity Module. Subscriber Identity Module. A small smart card that contains programming and information for small devices such as cell phones.
SPF
Sender Policy Framework. Sender Policy Framework (SPF) is a cyber security email authentication protocol that helps prevent email spoofing by allowing domain owners to publish a list of authorized mail servers in their domain's DNS records
STP
Shielded Twisted Pair. Secure Socket Tunneling Protocol. A tunneling protocol that encrypts VPN traffic using SSL over TCP port 443.
UAV
Unmanned Aerial Vehicle. Unmanned Aerial Vehicles (UAVs) are used in cybersecurity for security and surveillance but are also vulnerable to cyber threats like GPS spoofing, hijacking, and jamming.
VDE
Virtual Desktop Environment. A virtual desktop environment (VDI) in cybersecurity enhances security by centralizing data and applications on remote servers, protecting them from local device compromise and loss.
WEP
Wired Equivalent Privacy. Wired Equivalent Privacy. Original wireless security protocol. Had significant security flaws and was replaced with WPA, and ultimately WPA2. WEP used RC4 incorrectly making it susceptible to IV attacks, especially when the attacker used packet injection techniques.
XSRF
Cross-site Request Forgery. Cross-site request forgery. Attackers use XSRF attacks to trick users into performing actions on web sites, such as making purchases, without their knowledge. In some cases, it allows an attacker to steal cookies and harvest passwords.
DNSSEC
Domain Name System Security Extensions. A suite of specifications used to protect the integrity of DNS records and prevent DNS poisoning attacks.